12

For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) meeting NIST password guidelines and TOTP MFA should be more than enough.

Improve this question

1 Answer 1

Reset to default
22

SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor.

And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor.

And if your assessor is 4 years behind in their understanding of best practices in this area, then perhaps you need to find a new assessor ...

Improve this answer
10
  • 15
    Password Rotation is one of the worst ideas that people still think is legitimately useful. I can't even count how often I have seen <month><year> as password. Or <password><number> which keeps incrementing by one every few months.
    – user163495
    Apr 14, 2020 at 12:42
  • 3
    @MechMK1 if the password is automatically generated and submitted, it's actually a great idea. I mean, products exist that change passwords for accounts just after the password is used. It has its place, but just not with people.
    – schroeder ♦
    Apr 14, 2020 at 15:08
  • 9
    @MechMK1 at my first job we required rotation. My password was Password1, Password2, Password3..., Password9, Password1. Then I realized that you could change your password as frequently as you liked, so every 60 days I ran a Python script that changed my password 9 times.
    – Wayne Werner
    Apr 14, 2020 at 15:54
  • 4
    our proxy (squid) also used basic authentication over http, so I treated my password as public knowledge.
    – Wayne Werner
    Apr 14, 2020 at 15:55
  • 2
    @MechMK1 But <password><number> is a wonderful way to keep track of how long you have been at the company!
    – JiK
    Apr 15, 2020 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .